CVE-2025-0845 describes a stored cross-site scripting vulnerability in the DesignThemes Core Features WordPress plugin (versions up to 4.8). The issue arises from insufficient input sanitization and output escaping of user-supplied attributes in shortcodes, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability requires network access and low attack complexity but does not require user interaction beyond viewing the injected page.

Successful exploitation allows an authenticated user with contributor-level or higher permissions to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who access the injected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider disabling or limiting the use of shortcodes in the DesignThemes Core Features plugin. Monitor for updates from the vendor and apply patches promptly once available.